Windows cannot unload your registry file. 11

[LCannon]

I have several Win 2K Pro machines that are all getting
the following error in the Event Log.

Event ID 1000
Windows cannot unload your registry file. If you have a
roaming profile, your settings are not replicated. Contact
your administrator.

DETAIL - Access is denied. , Build number ((2195)).

What I'm finding in Microsoft's knowledge base is to
install SP3, but SP3 is all ready installed. I'm thinking
that I'll just reinstall SP3 but I'm not sure that will
work. Any suggestions?

 

[skeeterlogan]

My Remote Registry Service (which "Allows remote registry manipulation&quot has always been set to "Automatic" and has always been "up" since the installation of the Server. This error might well occur if this service is turned off, however since mine has never been off, and after uninstalling this hotfix did remedy this situation, I'll have to stand by this as a fix. If you look this up (Event ID 1000 with a source of USERENV) on

http://www.evenid.net,

you'll see that there can be many situations that can cause this to appear. The hotfix Q329170 is just one cause and uninstalling it is corresponding remedy.

 

[jkoch]

I too, am having the same problem. I do not utilize roaming profiles and get the error "windows cannot unload your registry file". I uninstalled the hotfix 329170 and I am still experiencing the problem on my Windows 2000 servers...can anyone help?!?!

Thanks!

 

[skeeterlogan]

Okay....NOW..this crazy error (Event ID 1000) has reappeared in my Event Viewer. Even after uninstalling hotfix Q329170. I went back to MMC (Microsoft Management Console) and back to "Local Computer Policy, Computer Configuration, Administrative Templates, System, Logon". In the "Maximum retries to unload and update user profile"...I HAD put that from the default of 60 to 0 on a tip from another user. In rethinking this, if I give it NO retry ability, it will fail for sure if it didn't unload it the first time. I changed it to a value of 5, rebooted and haven't seen the error since. Maybe it takes all of these fixes to get rid of this thing.

 

[raptor85]

Hey, this might not work in your case; however, recently I noticed this problem on my systems every time I shut down. I managed to stumble on the Userenv.log which had the line Bla Bla failed due to open registry key. If you use Regedit much at all make sure you close out all registry trees that are open. Worked great for me, even saves 20 or so seconds of hang on shutdown. Oh and either way you might be able to look at the Userenv.log file to get some ideas on why it is occuring.

 

[tomsolo]

Try installing directx 9. Don't know why but this got rid of the error for me. It is at the downloads sight of the microsoft web page. So far so good!

http://www.microsoft.com/downloads/search.aspx?displaylang=en

I think the .NET framework sp2 or windows media player 9 might be the cause of this problem. Don't no though.

 

[jkoch]

Thanks for the tips. Unfortunately, I tried all with no luck...still searching...

 

[DenAtHome]

I am in the process of re-building my system and the very first time this error occurred was on the restart process after installing disk 2 of the Microsoft Office 2000 SR-1a. Up until that time I did not have a problem and I was rebooting frequently with all the software installs.

Prior to the Office SR-1a installation I had installed the following:
Windows 2000 SP3
Most all of the hot fixes including Q329170
IE 6 SP1

I did not download the .NET framework SP or Media Player 9.

In my userenv.log file there is a line "Hive unload for S-1-5-21-2000478354-854245398-1343024091-500 failed due to open registry key." Is there some way to figure out what the string "S-1-5-21..." is?

 

[cmcl14]

I have the exact same symptoms as DenAtHome (with a different S-... number). Stopping the spooler service solves the problem. It seems like a network problem, but disconnecting the network or turning off the network printer have no effect. I think installing Windows Media Player 9 coincides with the beginning of this problem, but I'm not sure since I rarely turn off my computer and therefore don't log off too frequently. I guess I've solved the problem, but I'd rather not have to disable or turn off the spooler all the time. Anyone?

 

[cmcl14]

Just noticed something else:

60 seconds before Event ID 1000, I get the following event.

Event Type: Warning
Event Source: EventSystem
Event Category: Event Service
Event ID: 4106
Description:
The COM+ Event System detected a corrupt IEventSubscription object. The COM+ Event System has removed object ID {2286A472-F01F-4164-9B48-D5A11B2034F9}. The subscriber will no longer be notified when the event occurs.

I have no idea what this means... any ideas?

 

[charlieuser]

Been banging my head against the wall trying to figure out why Win2K was doing this, and why it was only for one user.

Then I found this page

http://www.win2000mag.net/Articles/Index.cfm?ArticleID=26569

which discussed the problem and referred to this page:

http://support.microsoft.com/default.aspx?scid=kb;en-us;q327984

According to MS Knowledge Base Article - 327984, the problem is occurring because "Your Profile Is Not Unloaded If You Change Printer Settings and Then Log Off"

Hope this helps!

best,
Charlie

 

[shoobe]

Hi everyone I am getting the same error event id 1000 running w2k prof, all the latest updates....I have this prob on 2 diff pc's....I am trying to reproduce the problem, but I am having no luck doing so....these pc's are not on a network and not logging into a domain. All local logins. I would like to try the patch offered by Microsoft but I cant afford to do so....can anyone help me out.

Thanks

 

[tomsolo]

Add a new user and copy the profile that is giving the error to the new user through the properties of my computer/advanced/user profiles. When I did this the problem didn’t move to the new user. Although I thought I had fixed this problem one time already but it returned shortly after my victory dance. Maybe this might be the one that works. Can’t hurt to try.

 

[DenAtHome]

A word of caution...
This problem, at least on my computer, is inconsistent. I kept a log as I continued to install software on my computer and for a while every other logoff had the problem. Then for a while 2 would work in a row followed by 2 that wouldn't. I have stopped keeping track but sometimes it works and sometimes it doesn't.

 

[Hondy]

I have the same problem. The cause appears to be from the 329170 security patch and addressed in Q814770 - not a public article (why??)

If you do NET STOP SPOOLER from a cmd prompt this "gets around" the problem and allows the roaming profiles to act normally until you reboot when the service starts again. Naturally this screws your printers up.

There is apparently a fix on the non-public Q814770 article, I'm not sure how you are supposed to get hold of it. This appears to be a well known fault, and Microsoft don't seem that bothered about it!

 

[JSF30]

Your registry has probably outgrown its allocated size. Go into: Settings|Control Panel|System|Advanced Tab -
Click on "Change" in Virtual Memory and increase the "Maximum registry size". Run "eventvwr" and right-click on any "error". Click on "Properties" to identify the error. Check that the error reports stop after you have increased registry size.

Hope this solves your problem, Joe.

 

[robinluo]

Here is what I did to my PC (and all other PCs with this problem), it's not a fix, but at least it will speed up the shutdown process:

1. Start -> Run -> gpedit.msc
2. Computer Cfg -> Admin Template -> System -> Logon
3. Enable "Maximum retries to unload and update user profile", and asign a new value (default is 60, means waiting 60 seconds before abort).

All the PCs I was working on is NOT using roaming profile, thus I don't care about if it's succesful or not to upload the profile. Event 1000 will be still added to your event log, but before we have a ultimate fix from Microsoft, at least I don't need to wait few minutes before shut down.

 

[snooka]

I know the problem has already been linked to a particular HotFix, but i don't have that HotFix installed on my PC and i still experience the problem that most of you have described.

It would only happen when "TightVNC" was started as a service, but the problem immediately goes away after starting it as an application. The error logged in the Event Viewer goes away as well.

In either case, modifying Group Policy will in fact fix (err...cover-up) the problem.

 

[mikeu812]

I applied the aforementionend Hotfixes and the IExplorer 6 Cumulative Patch a couple of weeks ago to a Win2k-DC and until now I have had no problems. But today I started experiencing the Logoff-Problems discussed in this thread.

So I uninstalled the Hotfix Q329170 and that fixed it.

 

[danomac]

Has anyone tried running oh.exe and seeing what registry key is still open?

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/oh-o.asp

There has been problems with IPSEC logons and the lsass.exe processes not closing the hive.

Daniel.

 

[DCL2Q]

I developed the logoff delay mid Dec when I did some updates. It did seem to be intermittant at times. Removed the Hot Fix q329170 and the problem ceases to exist!.

Thanks everyone!

David